Firewall: NAT: Source NAT: add pool options and source hash key (#10815)

Author: Monviech

src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogSNatRule.xml

@@ -211,6 +211,26 @@
             <min-width>60</min-width>
         </grid_view>
     </field>
+    <field>
+        <id>rule.poolopts</id>
+        <label>Pool Options</label>
+        <type>dropdown</type>
+        <help>Choose how traffic is distributed when multiple translation addresses are used. When nothing is selected, the current default is round-robin.</help>
+        <advanced>true</advanced>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
+    <field>
+        <id>rule.poolopts_sourcehashkey</id>
+        <label>Source Hash Key</label>
+        <type>text</type>
+        <help>Optionally specify a key to keep Source Hash mappings stable across ruleset reloads. Enter 0x followed by 32 hexadecimal digits.</help>
+        <advanced>true</advanced>
+        <grid_view>
+            <visible>false</visible>
+        </grid_view>
+    </field>
     <field>
         <id>rule.staticnatport</id>
         <label>Static-port</label>

src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php

@@ -186,6 +186,15 @@ public function performValidation($validateFullModel = false)
                                 $rule->{'endpoint-independent'}->__reference
                             ));
                         }
+                        if (
+                            !$rule->poolopts_sourcehashkey->isEmpty() &&
+                            !$rule->poolopts->isEqual('source-hash')
+                        ) {
+                            $messages->appendMessage(new Message(
+                                gettext("Source Hash Key is only valid for Source Hash type."),
+                                $rule->poolopts_sourcehashkey->__reference
+                            ));
+                        }
                     } else {
                         // Additional filter validations
                         if (!$rule->{'received-on'}->isEmpty() && $rule->direction != 'out') {

src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.xml

@@ -531,6 +531,20 @@
                     <EnableAlias>Y</EnableAlias>
                     <ValidationMessage>Please specify a valid port number, well-known name, alias or range.</ValidationMessage>
                 </target_port>
+                <poolopts type="OptionField">
+                    <OptionValues>
+                        <p1 value="round-robin">Round Robin</p1>
+                        <p2 value="round-robin sticky-address">Round Robin with Sticky Address</p2>
+                        <p3 value="random">Random</p3>
+                        <p4 value="random sticky-address">Random with Sticky Address</p4>
+                        <p5 value="source-hash">Source Hash</p5>
+                        <p6 value="bitmask">Bitmask</p6>
+                    </OptionValues>
+                </poolopts>
+                <poolopts_sourcehashkey type="StrictTextField">
+                    <Mask>/^0x[0-9a-fA-F]{32}$/</Mask>
+                    <ValidationMessage>Source Hash Key must be 0x followed by 32 hexadecimal digits.</ValidationMessage>
+                </poolopts_sourcehashkey>
                 <staticnatport type="BooleanField"/>
                 <log type="BooleanField">
                     <Default>0</Default>

src/opnsense/scripts/filter/list_legacy_outbound_nat.php

@@ -115,6 +115,8 @@ function legacy_target_to_network($rule)
             'destination_port' => normalize_port($rule['dstport'] ?? ''),
             'target' => legacy_target_to_network($rule),
             'target_port' => normalize_port($rule['natport'] ?? ''),
+            'poolopts' => $rule['poolopts'] ?? '',
+            'poolopts_sourcehashkey' => $rule['poolopts_sourcehashkey'] ?? '',
             'staticnatport' => !empty($rule['staticnatport']) ? '1' : '0',
             'log' => !empty($rule['log']) ? '1' : '0',
             'categories' => $rule['category'] ?? '',